In the HP case, I don't think they publicized or gave away that information to potentially harmful persons. Palin could legitimately fear identity theft while the HP case that was more invasive seemed to have a very small group of people accessing the private information. Basically, was there potential identity theft in either case? Kernell's jury was hung on that, if I remember. The other thing is that the HP employees didn't seem to want to press charges (aside from one, if I recall correctly). So the pretexting victims need to step up and remember, the telephone companies weren't the biggest victims, it was the actual phone account holders that had their records accessed via pretexting. I'm no legal expert on the issue but I think if the people whose records had been accessed stepped up to sue then the result would have been different. I imagine Palin will exercise all options in prosecuting Kernell and since she's not in anyway trying to salvage a relationship with Kernell he'll get the book thrown at him whether he's sorry or not.

Also, I read about this in ValleyWag [gawker.com] and didn't see it linked to in the summary. Not sure if theodp works there or if it was just coincidence but if this comparison was gleaned from there, some small credit should be given.

Ok, but in the Palin case, the former governor was using this email address to skirt public disclosure requirements. Palin is trying to play the victim here. She is the worst type of politician, and if our system was fair (which is impossible due to people like Palin), then she would be prosecuted as well.

As far as I'm concerned, Kernell did the public a service in helping to expose a corrupt politician.

You might be able to make the civil disobedience argument if he had, say, broken into the email account, downloaded everything, and sent it to a site like Wikileaks. Instead, he put the password on 4chan, and in the process he didn't really expose anything and delegitimized anything that might have been found.

Painting this kid as some sort of noble hacker/whistleblower is pure fantasy.

(At the same time, I do feel empathy for him, as we all know what law enforcement would do if someone broke into one of our personal webmail accounts: Absolutely nothing.)

I'm not saying you are or aren't in the group I'm about to argue with, because it's a bit unclear from your comment; but...

I've noticed that a lot of people throw around the "civil disobedience argument" as though they think it should be a legal defense. It isn't. It was never intended to be. The very concept of civil disobedience is that you accept the consequences of your actions, even if they be unfair consequences imposed by a corrupt regime. That's the nature of the play. If you don't like that part of it, then civil disobedience may not be for you.

So, yeah... he might have gotten a more sympathetic judge and/or jury if he'd done as you suggest, but he still would've gotten a criminal record and some sort of sentence out of the deal. Bottom line is having the best of intentions still doesn't make it ok to go outside the system. What crimes Palin did or didn't commit would be a separate matter, but don't expect evidence revealed in this manner to be what brings her down.

The very concept of civil disobedience is that you accept the consequences of your actions, even if they be unfair consequences imposed by a corrupt regime.

No. The very concept of civil disobedience [eserver.org] is "we should be men first, and subjects afterward. It is not desirable to cultivate a respect for the law, so much as for the right. The only obligation which I have a right to assume is to do at any time what I think right."

Thoreau didn't think to himself, "I'm going to go to jail to make a spectacle and sho

How you think that means he didn't accept the consequences of his actions is beyond me.

It rather sounds like you're arguing about the exact rationale he might have had for accepting the consequences of his actions; in which case you're arguing with yourself, because I did not (nor do I plan to) get into that topic.

The fact is, if you read his writings, or those of any other movement that utilized "civil disobedience", you will find that part of the deal is accepting that the government is going to enforce t

The fact is, if you read his writings, or those of any other movement that utilized "civil disobedience", you will find that part of the deal is accepting that the government is going to enforce the laws you disagree with.

"Accepting that the government is going to enforce the laws you disagree with" is accepting reality. If that's what's meant by "accepting the consequences of his actions", then it's true but so trivial as to be useless.

Public service or not, he broke the law in the hope of finding or creating a scandal. The law doesn't say "don't crack someone's email UNLESS when you do so you find something juicy". His success is immaterial. The penalty should be the same whether the account is full of lols and party invites or baby killing and kiddie porn.

Public service or not, he broke the law in the hope of finding or creating a scandal. The law doesn't say "don't crack someone's email UNLESS when you do so you find something juicy". His success is immaterial. The penalty should be the same whether the account is full of lols and party invites or baby killing and kiddie porn.

Two wrongs...

Actually, according to current law if you so much as FIND kiddie porn, you're immediately thrown in jail for the rest of your life. THINK OF THE CHILDREN....NO, NOT IN THAT WAY!

If I recall, it was assumed that merely having a personal email account was a means to skirt public disclosure requirements, but after multiple ethics investigations, they didn't find anything.

So was there proof she was doing "sekrit" business in her personal email account or not?

There were two different Yahoo accounts. One was personal (gov.palin@yahoo.com) and the other was used for government business (gov.sarah@yahoo.com). There is plenty of evidence [washingtonpost.com] of that, including emails reminding her aides to send to the gov.sarah account instead of the official state address. She even claimed to be unaware of any state laws regarding document retention. Alaska has since passed new legislation that specifically addresses what she was doing so that there can be no way to claim that such

Well, if they had to pass a clarifying law "since", then there must've been a way to make such a claim earlier -- when Sarah Palin was making it.

Thanks for the confirmation.

That's a logical fallacy. It is entirely possible and reasonably that what Palin was doing was illegal at the time she did it, regardless of what the Alaskan legislature did or did not pass after the fact.

It may have fallen in a slightly grey area which was enough for a powerful person, the state governor to get off the hook. This law

Ok, but in the Palin case, the former governor was using this email address to skirt public disclosure requirements.

I've heard this before, but based on what factual evidence? Since there was nothing substantial found in her Hotmail account, I don't see this claim as anything other than character sniping.
Further, comparing this to HP is a bit irrelevant; one is a citizen, one is a corporation; but either way, two wrongs make a right now? Is the gist here, since HP "got away" with something remotely similar, Kernell should be off the hook too? Or is it just maybe that HP should face a stiffer penalty?
I agree that 20

Ok, but in the Palin case, the former governor was using this email address to skirt public disclosure requirements. Palin is trying to play the victim here. She is the worst type of politician, and if our system was fair (which is impossible due to people like Palin), then she would be prosecuted as well.

As far as I'm concerned, Kernell did the public a service in helping to expose a corrupt politician.

Except Kernell DIDN'T FIND ANYTHING INCRIMINATING IN THE E-MAIL. This was her personal e-mail account. Kernell went looking for the state business there and DIDN'T FIND ANY. But God forbid that fact ever showed up.

No in the HP case they attacked more people and some of whom board members had high security clearnace Jobs they went after the DR heads of phone compnaies the ones who cary phones with two sims one of which is actived if a major disater hits and the govenment shuts down the mobile network to subs.

HP did also go after Journalists to get at thier sources who do have special protection underlaw for this. SP could also have been considdered to have violated a number of policies by using a webmail system ra

You managed to avoid the truly major difference in this case; The 20 year sentence is for felony obstruction of justice. The actual hacking of the e-mail account was only filed as a misdemeanor, and has a maximum sentence of 1 year.

What I find most interesting about this case is that the initial sentence is up to 1 year for the unauthorized access itself and 20 years for the "obstruction of justice". I just can't see how that punishment fits the crime.

Doesn't every criminal perform some sort of action to cover up their dirty deed? A bank robber might wear a mask. A burgular might wear gloves. A hitman might pick up a bullet casing.

Seems to me we shouldn't have a law like 'obstruction of justice' which can be applied to virtually any crime and carries a far stiffer sentance than would otherwise be constitutional. (In fact, how is 20 years for deleting a computer file on your own computer not cruel and unuusual punishment?)

Conspiracy charges are hard to convict on because they require just as much evidence and proof of guilt as non-conspiracy crimes, but don't inherently leave behind any such proof: it's easier to prove that somebody killed a person who is dead than that they planned to kill someone who isn't.

In practice, conspiracy charges only stick when plans are written down, recorded in a phone tap, a sting operation worked as intended, caught entirely on came

Obstruction occurs AFTER the initial crime and takes place during the investigation. It can be as simple as lying about the whereabouts of a person (I know someone arrested on misdemeanor obstruction for just this reason). Wearing a mask during the original crime doesn't count as obstruction because it does not occur during the investigation, but it could fall under other laws banning the wearing of masks in public.

Kernell is charged with two crimes; one crime is unauthorized access of a computer system and

What I find most interesting about this case is that the initial sentence is up to 1 year for the unauthorized access itself and 20 years for the "obstruction of justice". I just can't see how that punishment fits the crime.

Well it doesn't, obviously. However, obstruction of justice is a very wide ranging offence exactly because of the magnitude of the crime that is being covered up will itself vary widely. So, one would hope that a judge would take that into account when sentencing.

Trying to fix this, by reducing a judge's power to exercise discretion when sentencing, makes it more likely that you end up with punishments that don't fit the crime.

OK, I did that. Not one of the pages had any evidence linking HP to a crime. These were investigators hired to investigate, not HP employees asked to investigate. So unless you're going to cite some case law which is relevant you're not helping. I doubt the investigators would be considered employees. So google came back with the following two quotes.

"...[A]n employer is responsible for the actions of employees performed within the course of their employment."

You have your facts wrong. HP knew what the PIs were going to do and authorized them to do it anyway. A senior member of HP's general counsel, and, in fact, their director of ethics, was told of what the PIs planned, did "about an hour's worth of online research" on the legality of pretexting, and signed off on the plan.
http://schakowsky.house.gov/index.php?option=com_content&task=view&id=444&Itemid=17 [house.gov]

Right, and Al Capone never told anybody to kill people, he just told his lieutenants to "make this problem go away", and they did... permanently. I'm sorry, but you SHOULD be held responsible for the methods used by the people you are paying generously to gather information. Did the HP officers really think there was a perfectly legal way to get other people's confidential phone records from the phone company without their consent? I realize they get paid enough to afford really good drugs, but that disconn

Under American law, corporations have almost all privileges of citizenship without most of the responsibilities of citizenship. And people acting on behalf of a corporation have lots of legal protections that us regular schlemiels lack. They benefit extensively from the protection of the US military (both in and outside of US territory), and of course have ready access to all the more local services such as police, the fire department, municipal water supply, and so on. Thanks to the current Supreme Court, they also have full rights of political speech.

However, about the only responsibility of citizenship that they have to any degree whatsoever is that they are required to pay taxes, and many of them manage to dodge even doing that. Interestingly, if the interests of their shareholders conflict with the interests of the US, they are legally supposed to go with the shareholder's interest. So, for instance, if it is profitable to find a legal loophole that allows some subsidiary to sell uranium to Iran, a corporation capable of doing so is generally obligated to do just that.

The craziness of this: if Carly Fiorina pretexts to find out whether her husband is cheating on her, she's likely to be in a similar boat to David Kernell. If she pretexts to find out whether there's a leak on her board, she's now acting as a corporate officer, and thus the company is liable, not Carly, unless the prosecutor or plaintiff can convince a judge to pierce the corporate veil. Same person, same act, but in the second version there's an extra layer of legal protection.

One important component you left out: the greater ability of corporations to influence government -- Disney, Halliburton, GlaxoSmithKline [commondreams.org], etc. Other, more "polite", keywords to Google: rent seeking [wikipedia.org] and Public Choice Theory [wikipedia.org].

If she pretexts to find out whether there's a leak on her board, she's now acting as a corporate officer, and thus the company is liable, not Carly, unless the prosecutor or plaintiff can convince a judge to pierce the corporate veil.

This is just flat out wrong. There is no concept of "piercing the corporate" veil with respect to criminal prosecution. Veil-piercing is a product of civil law. Moreover, it is very common for corporate officers to face criminal prosecution for acts committed to further the corporate interest.

To convict a person of a crime, one must generally prove an illegal act committed with the proper state of mind (called mens rea, and in financial crimes this generally means intent to commit the ac). In many corporate scenarios, the mental state does not exist in a single person - it is spread out across many people - and is therefore very hard to prove. In some cases, this spreading out of responsibility is such that no single person ever had the necessary mental state necessary to support a conviction. Corporate prosecution is a way to punish such acts without abrogating our general principle that we don't punish people who didn't commit a crime. It is in addition to prosecution of persons, not instead of, and thus means that more crimes can be punished under our corporate laws than could be if those laws did not exist.

In sum, if a person commits a crime, the legal requirements for prosecution are the same whether committed to further a private or corporate interest.

As a side matter, Fiorina was not at HP when the investigation happened. Link [usatoday.com]. More importantly, there was little or no evidence that the chair at the time new about the pretexting before it took place. They hired a private investigator who engaged in pretexting. Although this is legally enough to warrant civil liability, it is not sufficient to support criminal liability.

Somehow I left out part of my post above: Although veil-piercing is relevant in the civil context, it does not apply with respect to an officer or director of a corporation. Veil-piercing is necessary to reach the shareholder of a corporation. In the HP case, it means that those who own HP stock can't be sued directly for the acts of the corporation or its officers.

The coproration provides no legal shield to its officers. Any officer who commited acts making him liable under the anti-pretexting laws is liab

We could also remove words such as running, sneaking, walking, jogging and sprinting and just say "going". Pretexting is a specific type of lie that means setting up the false pretext to be someone else - typically by using valid and/or confidential information about that person or by using the pretext over a prolonged period of time to make the ruse seem more convincing.

I appreciate having this extra bit of information instead of just saying "he lied".

Better yet, lets co-opt pretexting: How about "Today two men pretexted themselves into my grandma's house by claiming to be from the gas company, then stole all her valuables." What's the difference here?

LOL, there's obviously situations where it would confuse people. But the term itself is widely used as a form of "social engineering" (there's another one to pick apart) and is usually understood just fine in that context.

Pretexting is a specific type of lie that means setting up the false pretext to be someone else - typically by using valid and/or confidential information about that person or by using the pretext over a prolonged period of time to make the ruse seem more convincing.

Kernell does not face 2o years for pretexting. Kernell faces 1 year for unauthorized computer access and 20 years for felony obstruction of justice. To the best of my knowledge Kernell has not been sued by anyone over his unauthorized access.

HP settled a civil suit brought by Verizon for US$ 14 million. HP and the investigators hired who did the actual pretexting still face criminal charges. Those charge may result in jail time. There is little chance of a 20 year sentence as there is no felony obstruction charge in the HP case. Each count of unauthorized access carries a penalty which can run either concurrent or consecutive.

Verizon currently sells an HP netbook. HP may buy Palm, but there is no guarantee that Verizon will continue to carry Palm/HP phones. But, that US$ 14 million settlement may result in Verizon continuing to carry HP devices, especially if said devices are popular.

On November 2, 1988, Robert Tappan Morris Junior released his worm, on an Internet that at that time had very little security. It took down a significant chunk of the net, crashing thousands of machines. Morris's father was a bigwig in the national security establishment, Morris was an upper middle class WASP who went to Harvard. Despite all this damage, he did no jail time.

On January 24, 1990, in New York City, three MoD hackers were arrested. I had met all three before they were arrested. In terms of damage, only one machine they had ever been on had crashed, and all three denied crashing that one machine. There was no proof they had crashed it, and dozens of hackers had been on that Learning Link machine. Even if one had crashed it, which I don't believe, how can you accuse three people of the same crime? All three lived in poor or working class neighborhoods in New York, went to public schools etc. The judge said he would make an example of them and sent all three to jail.

I was 16 years old when they were arrested, and this was my first real experience seeing the "justice system" - an upper middle class WASP whose father was high in the military establishment admits he crashed thousands of machines and is called a misunderstood genius who made a mistake, and walks on charges. A year later three guys younger than him are arrested for crashing a computer which they all plausibly deny crashing (and how does it take three people to crash one computer anyhow), a computer which had dozens of other hackers on it. They come from working class neighborhoods in Queens, with modems connected to Commodore 64's, not Unix workstations at Ivy League schools like Cornell. They go to jail, Morris walks. An early lesson for me on how America really works.

David Kernell's father isn't exactly a poor working class nobody... Your point still stands but I thought I'd point that out.

The difference is subtle. It means that there isn't a minimum bar that you have to get over before justice evens out. Which would seem to make sense, if you can't hire a good lawyer you are obviously screwed. But that even amongst the very rich, the one with the deeper pockets still wins. Figuring out why that might be the case seems important.

O'Keefe et al entered a US Senator's office disguised as telephone repair men to tamper with the phone system. One accomplice is the son of a US attorney in Louisiana. All 4 were arrested by the FBI. All 4 skated.

"Justice" in these cases seems to depend quite heavily on whose political party your father belong

O'Keefe et al entered a US Senator's office disguised as telephone repair men to tamper with the phone system. One accomplice is the son of a US attorney in Louisiana. All 4 were arrested by the FBI. All 4 skated.

"Justice" in these cases seems to depend quite heavily on whose political party your father belongs to.

Not sure why the parent post gets modded as a troll. It's a very relevant point. Everyone seemed to be in favor of throwing the book at the guy that got into Palin's account (I can't call it hacking because it wasn't), but these guys try to tap a Senator's office phones and get off with a slap on the wrist?

That's a pretty good point. On the other hand, it's also true that public perception of this type of activity changed dramatically in the year that passed between those two events and the response by authorities had shifted considerably. 1989 was a pretty unique year.

For this reason, it's somewhat difficult to compare the two situations on the same grounds. It is unlikely that economic disparity is not the only influential factor.

There weren't really any good anti-hacking laws on the books in 1988. The Internet wasn't really on the public radar, and Morris did a lot to change that. I remember this time well because I was 20 years old in 1988 and was doing a lot of the same things Morris was. For anyone who could read a Unix man page, Internet security back then was a complete joke. Every system from pretty much every vendor was trivially hackable from the second the coax was attached. The thing that Morris did that the rest of us di

When Morris released the worm, there were no laws on the books specifically forbidding that activity, so there wasn't much they could charge him with. The MoD hackers were a test case for the new law that Morris' case led congress to pass. So yeah, it sucks, but you can't pass a law making something a crime and then charge someone for the crime of having done that thing before the law was passed. While there certainly are examples of the phenomenon you're talking about in law (e.g., the difference in sentencing for crack vs. powder cocaine), this is not such an example.

Pretexting
Pretexting is the act of creating and using an invented scenario (the pretext) to engage a targeted victim in a manner that increases the chance the victim will divulge information or perform actions that would be unlikely in ordinary circumstances. It is more than a simple lie, as it most often involves some prior research or setup and the use of a priori information for impersonation (e.g., date of birth, Social Security Number, last bill amount) to establish legitimacy in the mind of the target.[3]
This technique can be used to trick a business into disclosing customer information as well as by private investigators to obtain telephone records, utility records, banking records and other information directly from junior company service representatives. The information can then be used to establish even greater legitimacy under tougher questioning with a manager, e.g., to make account changes, get specific balances, etc. Pretexting has even been an observed law enforcement technique, under the auspices of which, a law officer may leverage the threat an alleged infraction to detain a suspect for questioning and close inspection of vehicle or premises.
Pretexting can also be used to impersonate co-workers, police, bank, tax authorities, or insurance investigators — or any other individual who could have perceived authority or right-to-know in the mind of the targeted victim. The pretexter must simply prepare answers to questions that might be asked by the victim. In some cases all that is needed is a voice that sounds authoritative, an earnest tone, and an ability to think on one's feet.

Okay... so I admit I'm no fan of Palin... But as a soon-to-be newly minted CISSP, people like Kernell make me sick.
However, when I see a 20 year sentence for his crime, vice 150 years for Madoff who stole tens of thousands of people's retirement, not put their information in the wind where there was potential of having money stolen... I can't help but think:
1. There is seriously something wrong with the way these crimes are sentenced - there needs to be either a specialized court system for computer-cen

Comparing an actual sentence to a hypothetical maximum sentence is not a useful exercise. Kernell hasn't been sentenced at all yet, let alone to 20 years. He was convicted of a crime that covers a wide range of activities - everything from lying to an FBI agent, to tampering with evidence, to bribing or blackmailing a witness. The federal sentencing guidelines define a series of fairly small ranges within that 20-year span based on the specific types of behavior and the defendant's criminal history. Althoug

He put palin's birthday (which is easily googleable) into yahoo's I forgot my password form. This guy is in no way a hacker/cracker. I bet there are cases of actual hackers getting busted for counts in the tens of thousands or hundreds of thousands of the same, or similar intrusions. And get about the same time.

..for what were originally serious felonies of trying to bug a U.S. senator's office in broad daylight in New Orleans. Helped that the co-conspirator was the son of a U.S. Attorney in Louisiana, one suspects. The leader is the same creep who pretended to be a 1970s pimp in order to smear ACORN with a faked the video. Now he's getting off with a slap on the wrist for stuff the Watergate burglars went to prison for.(They went into the Landrieu's office, in a federal building, and pretended to be a telephone r

..for what were originally serious felonies of trying to bug a U.S. senator's office in broad daylight in New Orleans. Helped that the co-conspirator was the son of a U.S. Attorney in Louisiana, one suspects. The leader is the same creep who pretended to be a 1970s pimp in order to smear ACORN with a faked the video. Now he's getting off with a slap on the wrist for stuff the Watergate burglars went to prison for.
(They went into the Landrieu's office, in a federal building, and pretended to be a telephone repair crew. The receptionist became suspicious when they asked her where the equipment closet was.)
http://www.nola.com/crime/index.ssf/2010/04/arraignment_set_in_sen_landrie.html [nola.com]

Someone's on a modding spree apparently. The parent post is certainly not off topic.

This kid is the son of a Tennessee State Representative . I don't think he could be classified as "poor". Sounds like his daddy has simply left him to suffer the consequences of his actions alone and on his own. I suppose in some way you could call that good parenting. My cynical nature requires that I admonish his father with "Mike, you shoulda just called a few favors and sprung the kid."

Can you imagine what would happen if every lame-ass action originating at 4chan resulted in 20 years?

Since when has any first-time offender committing a non-violent crime in a highly publicized case ever received the maximum sentence? I say he serves 2 years at most in a country-club prison, then a year or so of probation & no Internet. Alternatively, he may be sentenced to house arrest & no Internet.
Has anyone on here ever bothered to follow up on cases posted here to find out a) how long the sentence was b) if the offender actually went to jail?

His case illustrates the importance of not getting caught. Same thing goes for HP. When you're planning on doing some illegal shit, you really have to work not getting caught into your plan at a very early level. For example, in the HP case they could have out-sourced that to a foreign contracting firm for some plausible deniability. And in his case I'm sure he could have left a trail through proxies in 14 different countries or not picked such a high profile target that the FBI would get involved. And don'

Drawing inspiration from the cartoon world the other editors set up one of those pecking bird novelties to press whatever key moves a submission from the firehose to the front page. They play games with each other by manipulating the office thermostat to affect the rate of peck. When Taco is in the office you see fewer kdawson stories because Taco is warm natured.

I'm not sure this is how pecking birds work but if it isn't there is probably a pecking bird geek in the crowd who will correct me.

They named it kdawson because those are the letters the Chinese characters on its label look most like. Kind of a pinyin for the ignorant.

I'm not sure this is how pecking birds work but if it isn't there is probably a pecking bird geek in the crowd who will correct me.

Well, as a matter of fact, they need to dip into water.

Typically, older birds are filled with freon-11, or most modern ones with methylene chloride, in a liquid/vapor mix. They operate mainly by having the water soaking their heads evaporate. This changes the temperature of the refrigerant, causing it to change density (some turns from vapor to liquid) and alter the balance of the bird. Without a water supply to replenish the system, it would soon no longer be able to "peck" at the submit key.

They operate mainly by having the water soaking their heads evaporate. This changes the temperature of the refrigerant, causing it to change density (some turns from vapor to liquid) and alter the balance of the bird. Without a water supply to replenish the system, it would soon no longer be able to "peck" at the submit key.